Health Privacy in the Electronic Age

Click to increase image sizeClick to decrease image size Notes ∗Herbert F. Boehl Chair of Law and Medicine and Director, Institute for Bioethics, Health Policy and Law, University of Louisville School of Medicine. This article is based on a speech given March 21, 2007 at Southern Illinois University School of Law as the John and Marsha Ryan Bioethicist-in-Residence. The author is Chair of the Subcommittee on Privacy and Confidentiality of the National Committee on Vital and Health Statistics, which is referenced in the article. The views expressed herein are solely those of the author. 1Christine Borger et al., Health Spending Projections Through 2015: Changes on the Horizon, 25 Health Affairs Web Exclusive 2, w61 (Mar./Apr. 2006), available at http://content.healthaffairs. org/cgi/reprint/25/2/w61 (last accessed June 1, 2007) (estimating 2006 expenditures at $2.16 trillion). 2United States Department of Health and Human Services, Health, United States, 2006 with Chartbook on Trends in the Health of Americans 373 (National Center for Health Statistics 2006). 3See generally DAVID M. Cutler, Your Money or Your Life: Strong Medicine for America's Health Care System (2004); Maggie Mahar, Money-Driven Medicine: The Real Reason Health Care Costs So Much (2006) 4DEPARTMENT OF HEALTH AND HUMAN SERVICES, supra note 2, at 173 (ranking the United States twenty-eighth in infant mortality). 5Id. at 174 (ranking the United States twenty-sixth in life expectancy). 6 See NATIONAL COMMITTEE ON VITAL AND HEALTH STATISTICS, INFORMATION FOR HEALTH: A STRATEGY FOR BUILDING THE NATIONAL HEALTH INFORMATION INFRASTRUCTURE (Nov. 2001), available at http://www.ncvhs.hhs.gov/nhilayo.pdf (last accessed June 2, 2007). 7 See MARKLE FOUNDATION, CONNECTING AMERICANS TO THEIR HEALTH CARE: A COMMON FRAMEWORK FOR NETWORKED PERSONAL HEALTH INFORMATION (Dec. 2006), available at http:/www.connectingforhealth.org/commonframework/docs/p9_networkedphrs.pdf (last accessed June 2, 2007) 8Incentives for the Use of Health Information Technology and Establishing the Position of the National Health Information Technology Coordinator, Exec. Order No. 13335, 69 Fed. Reg. 24,059 (Apr. 30, 2004). 9 Id. 10 See MARKLE FOUNDATION, supra note 7, at 14-16. 11 See generally UNITED STATES GOVERNMENT ACCOUNTABILITY OFFICE, HEALTH INFORMATION TECHNOLOGY: EARLY EFFORTS INITIATED BUT COMPREHENSIVE PRIVACY APPROACH NEEDED FOR NATIONAL STRATEGY, GAO-07-238 (Jan. 2007). 12The National Committee on Vital and Health Statistics is the statutory public advisory body to the Secretary of Health and Human Services on health information policy. See www.ncvhs.hhs.gov 13NATIONAL COMMITTEE ON VITAL AND HEALTH STATISTICS, PRIVACY AND CONFIDENTIALITY IN THE NATIONWIDE HEALTH INFORMATION NETWORK (June 2006), available at www.ncvhs.hhs.gov/060622lt.htm (last accessed June 2, 2007). 14 Id. 15 Id. 16 Id. 17MARKLE FOUNDATION, CONNECTING FOR HEALTH, SURVEY FINDS AMERICANS WANT ELECTRONIC PERSONAL HEALTH INFORMATION TO IMPROVE OWN HEALTH 1 (Nov. 2006) available at http://www.markle. org/downloadable_assets/research_doc_120706.pdf (last accessed June 2, 2007). 18Conceptually, security issues are much easier to resolve than privacy and confidentiality issues. There is unanimity in the view that personal health information should be accessible only to people with authorization. By contrast, rules for privacy and confidentiality are much more contentious because they involve a difficult balancing of individual autonomy and dignitary interests with health care quality, public health, efficiency, and other valid interests. 19NATIONAL COMMITTEE, supra note 13. 20Under HIPAA Privacy Rules, individual consent or authorization is not required for disclosures for treatment, payment, or health care operations (TPO). 45 C.F.R. § 164.506 (2006). Although it could be argued the purpose of the network, ultimately, is to enhance TPO, the immediate purpose of the disclosure is not for TPO. Even if it were, an argument could be made that this provision of the Privacy Rule is insufficiently protective of patient privacy. 21 See generally Baruch A. Brody, Informed Consent and Refusal, in MEDICAL ETHICS: Analysis of the Issues Raised by the Codes, Opinions, and Statements 421 (Baruch A. Brody et al. eds., 2001). 22 See, e.g., Baruch A. Brody, Research Ethics, in MEDICAL ETHICS, supra note 21, at 791. 2345 C.F.R. § 164.508 (2006). 24If substantial numbers of people do not want to participate in the NHIN, then the answer is to make the benefits of participation outweigh the risks, rather than coercing participation or enrolling individuals without their knowledge or consent. 25A related issue is whether patients will be able to elect to opt into the NHIN on a one-time basis. For example, a patient may decline to participate in the NHIN, but be perfectly willing to allow the transmittal of his or her EHR to another physician for treatment purposes. In such an event, the physician probably would obtain one-time consent for transmittal. It remains to be seen whether this “single token” model of the NHIN will become popular with patients who have concerns about the privacy, confidentiality, and security of NHIN entities, but who want to take advantage of the benefits of electronic exchange of health information. 26Standards for Privacy of Individually Identifiable Health Information; Final Rule, 65 Fed. Reg. 82,462 & 82,810 (Dec. 28, 2000) (codified at 45 C.F.R. Parts 160 & 164); 45 C.F.R. § 164.506 (2000). 27Standards for Privacy of Individually Identifiable Health Information, as amended, 67 Fed. Reg. 53,182 (Aug. 14, 2002) (codified at 45 C.F.R. Parts 160 & 164); 45 C.F.R. § 164.506 (2002). 2845 C.F.R. § 164.520 (2006). 29 Id. §164.520(c)(2)(ii). 30 See National Committee on Vital and Health Statistics, Letter to Secretary Tommy G. Thompson (Sept. 27, 2002), available at http://www.ncvhs.hhs.gov/020927lt.htm (last accessed June 3, 2007). 3145 C.F.R. § 164.506 (2006). 32 Id. § 164.501 (definition of “marketing” excludes communications about products used in case management). 33American Medical Association Code of Medical Ethics § 7.05—Retention of Medical Records (2006). 34 Id. 35 SeeNational Committee, supra note 13. 36 SeeJOY PRITTS & KATHLEEN CONNOR, THE IMPLEMENTATION OF E-CONSENT MECHANISMS IN THREE COUNTRIES: CANADA, ENGLAND, AND THE NETHERLANDS (THE ABILITY TO MASK OR LIMIT ACCESS TO DATA), A REPORT TO THE SUBSTANCE ABUSE AND MENTAL HEALTH SERVICES ADMINISTRATION 5-6 (2007), available at http://ihcrp.georgetown.edu/pdfs/prittse-consent.pdf (last accessed June 3, 2007). 37Laura Plantinga et al., Disclosure, Confidentiality, and Families: Experiences and Attitudes of Those with Genetic Versus Nongenetic Medical Conditions, 119 AM. J. MED. GENETICS PART C 51, 55 (2003). 3845 C.F.R. § 164.501 (2006). 39Other sensitive health information may be recorded by social workers, marriage counselors, or other professionals who are not covered entities under HIPAA because, for example, they do not submit claims for their services in electronic format. 40Public Health Service Act, 42 U.S.C. § 290dd-2 (2006); 42 C.F.R. Pt. 2 (2006). 42 Genetic Information and Nondiscrimination Act of 2007, H.R. 493, 110th, Cong. 1st Sess. (2007). 42The state laws are compiled by the National Conference of State Legislatures and are available at www.ncsl.org/programs/health/genetics (last accessed June 3, 2007). 43 But see, e.g., Mark A. Rothstein, Genetic Privacy and Confidentiality: Why They Are So Hard to Protect, 26J.L. MED. & ETHICS 198 (1998). 44 See, e.g., Thomas H. Murray, Genetic Exceptionalism and “Future Diaries”: Is Genetic Information Different from Other Medical Information?,in Genetic Secrets: Protecting Privacy and Confidentiality in the Genetic Era (Mark A. Rothstein, ed. 1997); Deborah Hellman, What Makes Genetic Discrimination Exceptional?,29 AM. J.L. & MED. 77 (2003); Mark A. Rothstein, Genetic Exceptionalism and Legislative Pragmatism, 35 HASTINGS CENTER REP. NO. 4, at 27 (2005); Sonia M. Suter, The Allure and Peril of Genetic Exceptionalism, 79 WASH. U.L.Q. 669 (2001); Susan M. Wolf, Beyond “Genetic Discrimination”:Toward the Broader Harm of Geneticism,23 J.L. MED. & Ethics 23 (1995). 45Mark A. Rothstein & Meghan K. Talbott, Compelled Disclosure of Health Information: Protecting Against the Greatest Potential Threat to Privacy, 295 J.A.M.A. 2882 (2006). 46Mark A. Rothstein & Meghan K. Talbott, Compelled Authorizations for Disclosure of Health Records: Magnitude and Implications,7 AM. J. BIOETHICS 38 (2007). 47 Id. 4842 U.S.C. § 12112(d)(3) (2000). 49 See EQUAL EMPLOYMENT OPPORTUNITY COMMISSION, ENFORCEMENT GUIDANCE ON PREEMPLOYMENT INQUIRIES UNDER THE AMERICANS WITH DISABILITIES ACT (1994). 50AMERICAN MEDICAL ASSOCIATION, CODE OF MEDICAL ETHICS § 5.07(4) (2006). 51 See NATIONAL COMMITTEE, supra note 13, at Recommendations R-9 to R-11. 52 See 2002 NCVHS Letter, supra note 30. 53 See Department of Health and Human Services, Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. 82,462, 82,469 (Dec. 28, 2000). 54 Id. 5542 U.S.C. § 1320d-2 (2000). 56 Id. § 1320d-1(a) 57 Id. § 1320d-1(a)(3). 5820 U.S.C. § 1232g (2000); 34 C.F.R. Pt. 99 (2006). 59There is precedent for Congress to add new covered entities to HIPAA. When it enacted the Medicare Prescription Drug, Improvement, and Modernization Act of 2003, Pub. L. No. 108-173 (2003), Congress added prescription drug card sponsors to the list of HIPAA covered entities. 42 U.S.C. § 1395w-141(h)(6)(A) (West 2004). 60United States Department of Health and Human Services, Office for Civil Rights, HIPAA Privacy Rule Compliance Summary, available at http://www.hhs.gov/ocr/privacy/enforcement/ (follow “Privacy Rule Enforcement Highlights” hyperlink) (last accessed June 7, 2007) (as of Mar. 31, 2007, there were 26, 408 complaints). 61 Id. (384 referrals to the Department of Justice). 62 See NATIONAL COMMITTEE, supra note 13, Recommendation R-17. 63 Id.Recommendation R-15. 64GOVERNMENT ACCOUNTABILITY OFFICE, supra note 11, at 14.

Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.